Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-101104

Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Meari
Products
Iot Cloud Platform Openapi Service
CVE-2026-96613

Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Meari
Products
Iot Cloud Platform Openapi Service
CVE-2026-33356

Meari MQTT broker missing per-device subscribe ACL

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Meari
Products
Iot Cloud Mqtt Broker Emqx
CVE-2026-33357

Meari OpenAPI device status IDOR

In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary devices. The root cause is a server-side authorization failure in "GET /openapi/device/status".

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Meari
Products
Com.meari.sdk
CVE-2026-33359

Meari unauthenticated alert image access in cloud object storage

In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Meari
Products
Alibaba Oss Hosted
CVE-2026-33361

Meari weak XOR obfuscation

In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Meari
Products
Com.meari.sdk
CVE-2026-33362

Meari SDK hardcoded cryptographic keys

In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Meari
Products
Com.meari.sdk